<?php
require 'acdet.php';

$userName = $_POST['userName'];
$userPass = $_POST['userPass'];
$newUserPass = $_POST['newUserPass'];

$response = "";

$mysqli = new mysqli(DB_HOST, DB_USERNAME, DB_PASSWORD, DB_NAME);

$userName = $mysqli->real_escape_string($userName);
$userPass = $mysqli->real_escape_string($userPass);
$newUserPass = $mysqli->real_escape_string($newUserPass);

//pass crypt for checking
$iterationsCH = 1000;
$saltCH = count($userName) * 23;
$hashPassCH = hash_pbkdf2("sha256", $userPass, $saltCH, $iterationsCH, 25);

$sqlNamePass = "SELECT username = '$userName' FROM accounts WHERE userpass = '$hashPassCH'";
$resultNamePass = $mysqli->query($sqlNamePass);

if($resultNamePass -> num_rows < 1){
    $response = "UserPassNOTOK";
    //$response = $userName." ".$userPass;
} else {
    //pass crypt algo
    $iterations = 1000;
    $salt = count($userName) * 23;
    $hashPass = hash_pbkdf2("sha256", $newUserPass, $salt, $iterations, 25);

    $sqlPassChange = "UPDATE accounts SET userpass = '$hashPass' WHERE username = '$userName'";

    if($mysqli->query($sqlPassChange) === true){
        $response = "changeOK";
    } else {
        $response = "changeNOTOK";
    }
}

echo $response;

$mysqli->close();

?>